"""
Copyright (c) 2022 Huawei Technologies Co.,Ltd.

openGauss is licensed under Mulan PSL v2.
You can use this software according to the terms and conditions of the Mulan PSL v2.
You may obtain a copy of Mulan PSL v2 at:

          http://license.coscl.org.cn/MulanPSL2

THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
See the Mulan PSL v2 for more details.
"""
"""
Case Type   : 防篡改
Case Name   : 基于角色的帐号权限管理模型
Create At   : 2022/3/8
Owner       : @daiguatutu
Description :
    1.设置参数并重启数据库enableSeparationOfDuty=on
    gs_guc set -N all -I all -c enableSeparationOfDuty=on;
    gs_om -t restart
    2.创建新用户1,角色和表
    create user u_author_account_0008 identified by 'test@123';
    create role r_author_account_0008 identified by 'test@123';
    create table t_author_account_0008(id int);
    3.切换新用户1查询表
    select * from t_author_account_0008;
    4.授权表的select给自定义角色1,创建一个新用户2加入该角色
    grant select on t_author_account_0008 to r_author_account_0008;
    create user u_author_account_0008_1 in role r_author_account_0008
    password 'test@123';
    5.切换新用户2查询表
    select * from t_author_account_0008;
    6.清理环境
    drop table t_author_account_0008;
    drop user u_author_account_0008,u_author_account_0008_1,
    r_author_account_0008 cascade;
    gs_guc set -N all -I all -c enableSeparationOfDuty=off;
    gs_om -t restart
Expect      :
    1.成功
    2.成功
    3.失败
    4.成功
    5.成功
    6.清理环境成功
History     :
"""

import os
import unittest

from testcase.utils.Common import Common
from testcase.utils.CommonSH import CommonSH
from testcase.utils.Constant import Constant
from testcase.utils.Logger import Logger
from yat.test import Node
from yat.test import macro


class Security(unittest.TestCase):
    def setUp(self):
        self.log = Logger()
        self.log.info(f'-----{os.path.basename(__file__)} start-----')
        self.pri_node = Node(node='PrimaryDbUser')
        self.pri_sh = CommonSH('PrimaryDbUser')
        self.constant = Constant()
        self.common = Common()
        self.u_name = 'u_security_authen_account_0008'
        self.u_name_01 = 'u_security_authen_account_0008_01'
        self.r_name = 'r_security_authen_account_0008'
        self.t_name = 't_security_authen_account_0008'
        self.default_value1 = self.common.show_param('enableSeparationOfDuty')

    def test_security(self):
        text = '-----step1：设置参数并重启数据库enableSeparationOfDuty=on; ' \
               'expect:成功-----'
        self.log.info(text)
        mod_msg = self.pri_sh.execute_gsguc('set',
                                            self.constant.GSGUC_SUCCESS_MSG,
                                            'enableSeparationOfDuty=on')
        self.assertTrue(mod_msg, '执行失败:' + text)
        result = self.pri_sh.restart_db_cluster()
        self.assertTrue(result, '执行失败' + text)

        text = '-----step2：创建新用户1,角色和表 expect:成功-----'
        self.log.info(text)
        create_cmd = f"drop user if exists {self.u_name},{self.u_name_01}," \
            f"{self.r_name} cascade; " \
            f"create user {self.u_name} " \
            f"identified by '{macro.GAUSSDB_INIT_USER_PASSWD}';" \
            f"create role {self.r_name} " \
            f"identified by '{macro.GAUSSDB_INIT_USER_PASSWD}'; " \
            f"drop table if exists {self.t_name};" \
            f"create table {self.t_name}(id int);"
        msg = self.pri_sh.execut_db_sql(create_cmd)
        self.log.info(msg)
        self.assertEqual(2, msg.count(self.constant.CREATE_ROLE_SUCCESS_MSG),
                         '执行失败:' + text)
        self.assertIn(self.constant.DROP_ROLE_SUCCESS_MSG, msg,
                      '执行失败:' + text)
        self.assertIn(self.constant.DROP_TABLE_SUCCESS, msg, '执行失败:' + text)
        self.assertIn(self.constant.CREATE_TABLE_SUCCESS, msg,
                      '执行失败:' + text)

        text = f'-----step3：切换新用户1查询表; expect:失败-----'
        self.log.info(text)
        sql = f"select * from {self.t_name};"
        connect = f'-U {self.u_name} -W {macro.GAUSSDB_INIT_USER_PASSWD}'
        msg = self.pri_sh.execut_db_sql(sql, sql_type=connect)
        self.log.info(msg)
        self.assertIn(self.constant.PERMISSION_DENIED, msg,
                      '执行失败:' + text)

        text = '-----step4：授权表的select给自定义角色1,创建一个新用户2加入该角色 expect:成功-----'
        self.log.info(text)
        grant_sql = f"grant select on {self.t_name} to {self.r_name};" \
            f"create user {self.u_name_01} in role {self.r_name} " \
            f"password '{macro.GAUSSDB_INIT_USER_PASSWD}';"
        msg = self.pri_sh.execut_db_sql(grant_sql)
        self.log.info(msg)
        self.assertIn(self.constant.GRANT_SUCCESS_MSG, msg, '执行失败:' + text)
        self.assertIn(self.constant.CREATE_ROLE_SUCCESS_MSG, msg,
                      '执行失败:' + text)

        text = f'-----step5：切换新用户2查询表; expect:成功-----'
        self.log.info(text)
        connect = f'-U {self.u_name_01} -W {macro.GAUSSDB_INIT_USER_PASSWD}'
        msg = self.pri_sh.execut_db_sql(sql, sql_type=connect)
        self.log.info(msg)
        self.assertIn('0 rows', msg, '执行失败:' + text)

    def tearDown(self):
        self.log.info('-----step6：清理环境-----')
        text1 = '-----删除用户和表 expect:成功-----'
        self.log.info(text1)
        drop_cmd = f"drop table if exists {self.t_name}; " \
            f"drop user if exists {self.u_name},{self.u_name_01}," \
            f"{self.r_name} cascade;"
        drop_msg = self.pri_sh.execut_db_sql(drop_cmd)
        self.log.info(drop_msg)

        text2 = '-----修改参数enableSeparationOfDuty为初始值并重启数据库 expect:成功-----'
        self.log.info(text2)
        mod_msg1 = self.pri_sh.execute_gsguc('set',
                                             self.constant.GSGUC_SUCCESS_MSG,
                                             f'enableSeparationOfDuty='
                                             f'{self.default_value1}')
        restart_res = self.pri_sh.restart_db_cluster()

        self.log.info('-----断言tearDown执行成功-----')
        self.assertIn(self.constant.DROP_TABLE_SUCCESS, drop_msg,
                      '执行失败:' + text1)
        self.assertIn(self.constant.DROP_ROLE_SUCCESS_MSG, drop_msg,
                      '执行失败:' + text1)
        self.assertTrue(mod_msg1, '执行失败:' + text2)
        self.assertTrue(restart_res, '执行失败:' + text2)
        self.log.info(f'-----{os.path.basename(__file__)} end-----')
